Sophos cuts threat investigation time by 96% with OpenAI Daybreak

Sophos has reported that it cut threat investigation time by 96% by using OpenAI Daybreak, according to an announcement from OpenAI News. The security vendor also said it automates 52% of its MDR cases with the system, which it says preserves human oversight.

MDR, or managed detection and response, is a service in which a security provider monitors a customer's environment and handles detected incidents on their behalf. Those workflows depend on analysts triaging alerts, gathering context about suspicious activity and deciding how to respond, all of which takes time.

The two figures are the core of the claim: a 96% reduction in investigation time and automation of just over half of MDR cases. The announcement frames the remaining work as still involving human oversight, which suggests the automated path handles a portion of cases rather than replacing analyst judgment entirely.

For developers and product teams building security tooling, this points to where automation is being applied in the analyst workflow: the investigation step, not the whole response process. A likely trade-off is that faster triage shifts the human role toward reviewing and validating automated conclusions rather than performing the initial investigation. Whether the time savings hold across varied customer environments is an inference, since the announcement does not break the numbers down by case type.

Why it matters: teams evaluating AI in security operations now have a vendor-stated benchmark to compare against, though the 96% and 52% figures are Sophos's own and reported without methodology here. The practical question for MDR providers and their customers is how much analyst capacity moves from investigation to oversight, and whether that changes staffing or service economics. For developers, it signals continued demand for AI-assisted triage integrated into existing detection pipelines.